While working on SELinux-enabling a Debian system, I often Google for
avc messages that show up in dmesg and 90% of the time it seems that the
problem has already been solved in Fedora's version of the refpolicy but
not in the upstream version.
Googling a bit more lead me to these emails:
http://marc.info/?l=selinux&m=121155835630301&w=2
http://marc.info/?l=selinux&m=121622105928866&w=2
The latest Fedora patch:
http://cvs.fedoraproject.org/viewcvs/devel/selinux-policy/policy-20080710.patch?rev=1.2&view=auto
Is 36918 lines totalling over 1.1 Mb.
The latest Debian patch:
http://ftp.de.debian.org/debian/pool/main/r/refpolicy/refpolicy_0.0.20080702-1.diff.gz
Is 8759 lines totalling 258Kb (but that includes the build scripts).
I wrote a quick python script that splits the Fedora patch into
per-module patches (much like the ones Daniel J Walsh posted, only that
I get 214 patches) and I'm prepared to start going over these patches
seeing which ones are relevant and which ones would need some changes to
work in Debian as well (for instance, lots of *.fc files would need to
have lines like /etc/rc.d/init.d/something changed to
/etc/(rc.d/)?init.d/something to work in both RH and Debian).
The question is how to treat the patches after that? Should I post them
as I go through them (a couple per day for a couple of weeks?) and hope
that someone at Tresys will apply them?
Also, Daniel, do you think it would be possible to change the Redhat
build scripts to take a directory of patches instead of the huge patch
it uses right now? It would make it much much easier to track the
differences if the changes to each module was tracked in one patch in
the CVS repo. It would also make it clearer what each change does (not
at all clear sometimes with the current huge patch...comments and/or
links to bugzilla entries would have been great) as each change to each
patch will at least have the commit message to go along with it.
And in the end...does it really help? Someone at Tresys will have to
review every patch anyway...so should I start looking at patches?
--
David Härdeman
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
